T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/word_demo.py:178
- Finding
- Unsaved Document Content Can Be Deleted Without Verifying That the Document Is Blank<![CDATA[ ## Vulnerability Details **File Location**: `scripts/word_demo.py`, lines 178-190 **Vulnerability Type**: Unsafe destructive document handling **Risk Level**: Medium ### Vulnerable Code ```python def get_or_create_doc(word): """获取或创建文档：复用第一个未保存的空白文档，否则新建""" try: if word.Documents.Count > 0: for i in range(1, word.Documents.Count + 1): doc = word.Documents.Item(i) if not doc.Saved: print(f'[文档] 复用已有文档: {doc.Name}') # 清除内容，准备写入新内容 try: doc.Content.Delete() except: pass return doc except: pass return word.Documents.Add() ``` ### Technical Analysis The function is documented as reusing an unsaved **blank** document, but the only eligibility check is `not doc.Saved`. An unsaved document is not necessarily empty: it may contain newly created or modified user content. Once such a document is selected, `doc.Content.Delete()` removes its entire contents without verifying that the document is blank and without requesting user confirmation. Broad exception handlers suppress errors, making destructive or partially failed operations less visible. The script uses `DispatchEx("Word.Application")`, which normally creates a separate Word instance and reduces exposure to documents in an existing user-controlled Word instance. However, the helper does not enforce that assumption. If the automation instance contains a non-empty unsaved document, the deletion still occurs. ### Attack Path 1. A non-empty unsaved document becomes available through the Word COM instance used by the script. 2. `get_or_create_doc()` enumerates the documents in that instance. 3. The function treats the document as reusable solely because `doc.Saved` is false. 4. `doc.Content.Delete()` deletes all existing document content. 5. The typewriter process writes generated ...[truncated 684 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer creating a new document unconditionally: ```python def get_or_create_doc(word): return word.Documents.Add() ``` 2. If document reuse is required, verify that the candidate is genuinely blank before deleting or modifying it. Account for Word's terminal paragraph marker: ```python def is_blank_document(doc): text = doc.Content.Text return text in ("", "\r", "\r\n", "\x07", "\r\x07") def get_or_create_doc(word): for i in range(1, word.Documents.Count + 1): doc = word.Documents.Item(i) if not doc.Saved and is_blank_document(doc): return doc return word.Documents.Add() ``` 3. Never call `doc.Content.Delete()` on a non-empty document without explicit user confirmation. 4. Track whether the script created the document. During cleanup, only close documents owned by the script. 5. Replace bare `except:` handlers with specific exception handling and clear error reporting so destructive-operation failures are not silently suppressed. 6. Before closing with `SaveChanges=False`, verify that the document is the script-created output and that any requested save operation completed successfully. ]]>